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We consider the continuous-variable protocol of Pirandola et al. [Nature Photonics 9, 397-402 
(2015), see also arXiv. 1312.4104] where the secret-key is established by the measurement of an 
untrusted relay. In this network protocol, two authorized parties are connected to an untrusted 
relay by insecure quantum links. Secret correlations are generated by a continuous-variable Bell 
detection performed on incoming coherent states. In the present work we provide a detailed study of 
the symmetric configuration, where the relay is midway between the parties. We analyze symmetric 
eavesdropping strategies against the quantum links explicitly showing that, at fixed transmissivity 
and thermal noise, two-mode coherent attacks are optimal, manifestly outperforming one-mode 
collective attacks based on independent entangling doners. Such an advantage is shown both in 
terms of security threshold and secret-key rate. 

PACS numbers: 03.67.Dd, 03.65.-w, 42.50.-p, 89.70.Cf 


I. INTRODUCTION 

Rather than layers of physical security or obscure cod¬ 
ing in the distribution of a classical key [T|, quantum 
cryptography claims to rely on the fundamental laws of 
quantum physics to provide secure quantum key distri¬ 
bution (QKD) Q. In the simplest scheme, information 
is encoded on non-orthogonal states which are transmit¬ 
ted from Alice to Bob via a quantum channel. After 
classical procedures of error correction and privacy am¬ 
plification, Alice and Bob are then able to distill shared 
secret bits [Ij . Any attempt by Eve at gleaning informa¬ 
tion inevitably introduces noise in the quantum channel; 
by quantifying this noise, Alice and Bob determine how 
much distillation must be applied to make Eve’s infor¬ 
mation negligible or if there is too much noise (breaching 
the security threshold) they abort the protocol. 

Over the last several decades, QKD has been imple¬ 
mented many times, more recently even in simple net¬ 
work configurations ■ By utilizing an iterated point- 
to-point strategy, a secret key may be shared with legit¬ 
imate users on more distant network nodes. This strat¬ 
egy explicitly requires secure and trusted intermediate 
relay stations. However, modern communication proto¬ 
cols (e.g., TCP/IP) rely on a more advanced ‘end-to-end 
principle’ @,0 with simple, unreliable and untrusted re¬ 
lays; any layers of security are provided by the two end- 
parties. 

A first step in this direction has been done by Ref. Q , 
which extended QKD to the mediation of an untrusted 
relay, void of quantum sources (e.g., entanglement) and 
performing a quantum measurement which generates 
secret correlations in remote stations. This idea of 
a measurement-based untrusted relay (also known as 
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‘measurement-device independence’) has been experi¬ 
mentally implemented with discrete variables iP- 

More recently, the use of measurement-based un¬ 
trusted relays has been introduced in continuous-variable 
QKD m with the aim of exploiting the advantages 
of bosonic systems [H, [T^ in terms of cheap quantum 
sources and highly-efScient detectors. Indeed this pro¬ 
tocol is able to achieve secret-key rates orders of magni¬ 
tude higher than any protocol based on discrete-variable 
systems. This is possible thanks to the use of the cheap¬ 
est possible quantum sources, i.e., coherent states, com¬ 
bined with simple linear optics and homodyne detectors 
at the relay station. Ref. [ij found that the optimal per¬ 
formances are achieved in the asymmetric configuration 
where the relay is close to one of the parties. 

In this paper, we deepen the analysis of Ref. [ll| con¬ 
sidering the symmetric configuration where the relay is 
midway between Alice and Bob. Despite the fact this is 
not the optimal setup in terms of rates and security dis¬ 
tances, it is still very important to analyze for potential 
applications in network scenarios where two parties are 
roughly equidistant from a public server or access point. 
Another reason for analyzing this kind of setup is in its 
simple analytical formulas for the secret-key rates. Us¬ 
ing these formulas, we can provide a very detailed com¬ 
parison between the most important Gaussian attacks 
against the quantum links. 

In our cryptanalysis of the symmetric protocol we 
clearly show that, at fixed transmissivity and thermal 
noise on the links, the optimal eavesdropping strategy 
is a two-mode coherent Gaussian attack, where Eve in¬ 
jects quantum correlations in both the quantum chan¬ 
nels leading to the relay. In this attack, these channels 
are combined (via beam-splitters) with two entangled 
modes, which have been prepared in a suitable Einstein- 
Podolsky-Rosen (EPR) state. Such a strategy greatly 
outperforms the single-mode collective attack based on 
two independent entangling doners which was assumed 
in some recent investigations [l6l - [l8j| . Any such security 
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analysis relying on independent attacks on the channels 
is therefore incomplete and opens security loopholes. 

The paper is organized as follows: In Section [H] we 
describe the setup in the symmetric scenario. In Sec¬ 
tion uni we analyze its security and provide a formula 
for the key rate. In Section ITVl we compare the various 
Gaussian attacks, identifying the optimal attack and the 
corresponding minimum key rate of the protocol. Finally, 
in Section]^ we draw our conclusions. 



II. THE PROTOCOL 

Let us consider the scenario where Alice and Bob do 
not access a direct communication link. Instead they 
connect to a perfectly-in-the-middle relay via insecure 
quantum links, as shown in Fig. [IJa). The relay is un¬ 
trusted, meaning that it is assumed to be operated by 
Eve in the worst case scenario. 

The protocol proceeds as follows: Alice and Bob pos¬ 
sess two modes, A and B, which are prepared in coherent 
states, ja) and |/3), with randomly-modulated amplitudes 
(according to a complex Gaussian distribution with large 
variance). They send these modes to the intermediate 
relay where the output modes. A' and B', are subject 
to a continuous-variable Bell detection [l^. This means 
that A! and B' are mixed on a balanced beam splitter 
and the output ports are conjugately homodyned: One 
port is homodyned in the q-quadrature with outcome q_, 
while the other port is homodyned in the p-quadrature 
with outcome p+. Gompactly, the measurement provides 
the complex outcome 7 := (q_ -I- ip+)/-\/2 which is then 
broadcast over a public channel. 

To understand the working mechanism of the relay, 
first suppose there is no loss and noise in the links. In 
such a case, we have 7 ~ a — /3*, so that the communica¬ 
tion of 7 creates a posteriori correlations between Alice’s 
and Bob’s variables. Each party can easily infer the vari¬ 
able of the other. For instance, Alice could compute the 
quantity a — 7 (3* recovering Bob’s encoding /3 up to 

detection noise [^. This procedure partly recalls the 
post-processing of the two-way QKD protocols [13, Hlj . 

Note that Eve’s knowledge of variable 7 would be of no 
help to extract information on the individual variables a 
and /3, i.e., we have J(a : 7 ) = /(/3 : 7 ) = 0 in terms of 
mutual information [22, [23|. By contrast, as a result of 
the broadcast of 7 , the conditional mutual information of 
Alice and Bob becomes non-zero I(a : / 3 | 7 ) > l{a : /3). 
Thus, if Eve wants to steal information, she needs to 
introduce loss and noise. 

In general, the action of Eve may involve a global 
unitary operation correlating all the uses of the pro¬ 
tocols. However, using random permutations of their 
data [H, [131 , Alice and Bob can always reduce this sce¬ 
nario to an attack which is coherent within the single 
use of protocol. This can be a joint attack of both the 
links and the relay. The parties can further reduce this 
eavesdropping to consider a coherent attack of the links 
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FIG. 1: (Color online) (a) Relay-based protocol performed 
in the symmetric configuration with the untrusted relay per¬ 
fectly in the middle between the parties. Alice and Bob pre¬ 
pare coherent states with Gaussianly-modulated amplitudes, 
a and /3, respectively. The relay performs a continuous- 
variable Bell measurement with complex outcome 7 := (q_ -|- 
which is publicly broadcast. From the knowledge 
of 7 each party can infer the variable of the other party, 
(b) Entanglement-based representation of the protocol under 
two-mode Gaussian attack. Using two beam splitters with 
transmissivity r, Eve injects to ancillary modes, E\ and i 52 , 
prepared in a two-mode Gaussian state with zero mean and 
CM in the symmetric normal form of Eq. 13 ). See text for 
details. 


only, assuming a properly-working relay, i.e., a relay im¬ 
plementing a continuous-variable Bell detection. In par¬ 
ticular, since the protocol is based on the Gaussian mod¬ 
ulation and Gaussian detection of Gaussian states, the 
optimal coherent attack of the links will be based on a 
Gaussian unitary interaction [IM3|. See Ref. [Hi for 
more details about this general reduction of the attack. 


III. CRYPTOANALYSIS OF THE PROTOCOL 

According to the previous discussion, we can reduce 
the attack to a two-mode Gaussian attack against the 
quantum links of Alice and Bob. The most realistic im¬ 
plementation of such an attack consists of two beam split¬ 
ters combining the signals with ancillary modes prepared 
in a generally quantum-correlated Gaussian state (more 
exotic Gaussian attacks may be constructed using other 
canonical forms [ 13 ). In particular, we will consider the 
symmetric configuration of this attack, where the param¬ 
eters are identical for the two links, so that the perfor¬ 
mances of the protocol are invariant under exchange of 
Alice and Bob. In order to analyze this symmetric Gaus¬ 
sian attack, we adopt the entanglement-based (EB) rep- 
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resentation of the protocol, where Alice’s and Bob’s en¬ 
sembles of coherent states are simulated using two EPR 
states subject to local heterodyne detections. 


A. Entangled-based representation 


The EB-representation of the protocol is described in 
Fig. [TJb). Alice and Bob possess two EPR states, 4 
and pbB, with the same covariance matrix (CM) [l3| 





pi 


( 1 ) 


where I = diag(l, 1), Z = diag(l, —1) and p > 1. 

By applying heterodyne detections to the remote 
modes, a and b, Alice and Bob prepares coherent states, 
|a) and |/3), on the other EPR modes, A and B, respec¬ 
tively. In particular, their amplitudes, a and P, are mod¬ 
ulated according to a complex Gaussian distribution with 
variance ip := p — 1, that we take to be very large ip ^ 1. 
Modes A and B are then sent to the relay for detection. 


B. Symmetric two-mode Gaussian eavesdropping 

Alice’s and Bob’s modes A and B are mixed with an¬ 
cillary modes, Ei and E 2 , respectively. This is done by 
means of two beam-splitters with the same transmis¬ 
sivity T. The ancillas belong to an environmental set 
{Ei,E 2 ,e} in the hands of Eve, and the reduced state 
of El and E 2 is a zero-mean Gaussian state with 

GM in the symmetric normal form 


Thanks to this symmetry, we can reduce the number of 
parameters and derive a simple analytical expression for 
the secret-key rate, which allows us to perform a detailed 
analysis of the various specific symmetric attacks which 
are possible against our protocol. In particular, we can 
easily study the performances of these attacks in terms of 
the correlation parameters, g and g', and identify the op¬ 
timal one which minimizes key rate and security thresh¬ 
old. Furthermore, due to the symmetry, Alice and Bob 
can be interchanged, which implies that there is no dif¬ 
ference between direct and reverse reconciliation [T^ . In 
other words, we can consider a unique secret-key rate for 
the protocol (assuming one-way classical communication 
for error correction and privacy amplification). 


C. Secret-key rate 


Without loss of generality, we assume that Alice is the 
encoder of information (variable a) while Bob is the de¬ 
coder, so that he post-processes his variable (3 to infer 
a. In the EB-representation, these variables are infor¬ 
mationally equivalent to the outcomes of the heterodyne 
detections [ll|. To derive the rate, we note that the 
Bell detection at the relay and the heterodyne detections 
of the two parties commute with each other. For this 
reason, we can equivalently compute the rate from the 
conditional state Pa &|7 of modes a and b after the com¬ 
munication of the outcome 7 . The rate is given by m 

^ ^ab\-y -^£^ 17 ? ( 4 ) 


Here w is the variance of the thermal noise injected in 
the beam splitters, while G accounts for the quantum 
correlations between the two ancillas. (The various pa¬ 
rameters w, g, and g' satisfy simple physical constraints 
imposed by the uncertainty principle 

The output modes. A' and R', are subject to the 
continuous-variable Bell detection (with the outcome 
broadcast), while Eve’s output modes, E[ and E 2 , to¬ 
gether with all the other ancillary modes e are stored 
in a quantum memory, which is detected by an optimal 
coherent measurement at the end of the protocol. 

Note that we may consider different transmissivities, 
ta and tb, for the beam splitters, and an asymmetric 
GM with different thermal variances, uja and ujb- This 
is the general asymmetric case considered in Ref. [HI- 
However, when the relay is midway between the two par¬ 
ties, the amount of loss and noise present in the links is 
realistically expected to be identical. In other words, it 
is reasonable to consider here a symmetric attack as the 
one previously described, which has 

TA = Tb := r, uja = ojb ■= uj . (3) 


where Iab\-y is Alice and Bob’s conditional mutual infor¬ 
mation, while lE\-y is Eve’s Holevo information [ 2 ^ on 
Alice’s variable (which can be computed from the state 
of the output ancillas). 

Since all output modes are in a global pure state and 
the various detections are rank- 1 , we can write [TTj | 

^E\'y ^{^Pb\'ya')} (^) 

where S{.) is the von Neumann entropy [ 2 ^, computed 
on the post-relay state Pob |7 of Alice and Bob, and the 
double-conditional state Pb\-ya of Bob, conditioned to re¬ 
lay’s and Alice’s detections (computable from Pablj)- 


D. Computation of the key rate 

Both the mutual information /ab |7 and Eve’s Holevo 
entropy lE\-y can be computed from the post-relay state 
Pab\-y, in particular, from its GM Imposing the 

symmetry conditions of Eq. in the general expression 
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of V(j 5 |^ computed in Ref. m , we derive 


nh\’^ 




'’It' “ 0 /il 

/ 


r/i+A 


r/i+A' 

1 1 
r/^+A r/i+A 

r/i+A' 


( 6 ) 


T/i+A 


T/i+A' 


r/i+A' / 


where 


A := (1 - t){uj - g), A' := (1 - r)(a; + g'). (7) 


Note that Eq. © represents a particular case of the gen¬ 
eral CM of Eq. (lAlOE which is obtained in the Appendix, 
where non-unit quantum efficiencies of the detectors are 
also included. 

Now, we can easily compute [l^ the symplectic spec¬ 
trum of eq.® in the limit of large modulation p. ^ 1, 
obtaining 


/ 

\ — , 1^2 -t 
V T 


( 8 ) 


Then, entropy term S{pah\-y) in Eq. ® can be computed 
using the function 


,,, cc-l-l, X + 1 X — 1 ^ X — 1 
Kx) ■■= log2 ^- — log2 

—>■ log ^x + O [ — ] for a; 1. 


( 9 ) 
( 10 ) 

z, yu; / 

Thus, we have 

S{Pab\-i) = Kvi) + h{v 2 ) -)> log ^^AA/r. (11) 


To compute S{p^ja) derive the double-conditional 
CM We put Eq. ® in the block-form 


"^0617 


A C 
B 


( 12 ) 


and we apply a partial gaussian heterod yne measurement 
on Alice’s remote mode a,given by [la. Hg. . 

Vfc|^„ = B-C^(A + I)-'C, (13) 

which gives 




T (/i-t-l)-t-2 A 
0 


0 

(/i^ —1 )t 
T(;i-|- 1 )-|- 2 A 


(14) 


For pL^ 1, its symplectic eigenvalue is given by 


•\/(t -|- 2A)(t -|- 2A^) 


( 15 ) 


and we have S{pi,\^a) = h{iy). We can then compute 
Eve’s Holevo information, asymptotically given by 


IeI’J — log2 


e^^/W p 
4t 


— h 


\/(t 2A)(t -|- 2A^) 

T 


(16) 


Alice and Bob’s conditional mutual information lablj can 
be computed from the classical CM V(q;, /Jjy) = (Vaj,|..y-|- 
I)/2 describing their outcomes. After simple algebra, we 
get the asymptotic expression 


IabI't = log2 


_ ^ _ 

4a/(t +A)(r-h A') 


(17) 


As a result, we computed the following asymptotic secret- 
key rate for the symmetric Gaussian attack 


R 


sym 


= l 0 g 2 


e'^y^XX'{T -I- A)(r -I- A') 


\/(T + 2A)(r + 2A') 


(18) 


which is function of the parameters t, u>, g and g'. 

A complete analysis of the performances of the scheme 
in presence of non-ideal experimental conditions is de¬ 
scribed in Appendix 


IV. DETAILED ANALYSIS OF THE 
SYMMETRIC ATTACKS 

For fixed transmissivity t and thermal noise uj affecting 
each link, there are remaining degrees of freedom in the 
two-mode Gaussian attack. These are given by the corre¬ 
lation parameters g and g' , which can be represented as 
a point on a ‘correlation plane’ (see Fig. ® . Each point 
of this plane describes an attack (with different amount 
and kind of correlations) to which it corresponds a spe¬ 
cific key rate according to Eq. (ITSl) . Here we provide a 
detailed comparison between these attacks, showing how 
the optimal coherent attack greatly outperforms the col¬ 
lective attack based on independent entangling doners. 

Because of the symmetry, we have a simple character¬ 
ization of the set of possible Gaussian attacks which are 
accessible to Eve. These correspond to points (q, q') such 

that mm 


\g\ < w, \g'\ < w, (19) 

^ Iff + ff^l + gg' — 1. (20) 

Among all these accessible attacks, those satisfying the 
further condition 

- ffff'- 1 > w |5 - 5 '| ( 21 ) 

are separable attacks {(JeiE 2 separable), while those vio¬ 
lating Eq. (1^ are entangled attacks {(TEiE 2 entangled). 
See Fig. [2] for a numerical representation. In particular. 


T 
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FIG. 2: (Color online) Correlation plan for a symmetric Gaus¬ 
sian attack. Given r and cu (here set to 2), the attack is fully 
specified by the two correlation parameters {g,g'), whose ac¬ 
cessible values are represented by the non-white area. In par¬ 
ticular, the inner darker region represents the set of separable 
attacks {(jexE 2 separable), while the two outer and lighter 
regions represent entangled attacks entangled). The 

numbered points represent the specific attacks described in 
Sec.HVl 


we can identify the following attacks: 

Collective attack. This is the simplest attack, repre¬ 
sented by point ( 1 ) in Fig. [21 i.e., the origin of the plane 
{9 = 9 ' = ^)- This corresponds to using two identical and 
independent entangling doners with transmissivity r and 
thermal noise uj. In fact, we have crEiE 2 = ctei ® cfE 2 ^ 
where (fc = 1 , 2 ) is a thermal state with variance w, 
whose purification ^EkCk is an EPR state in the hands 
of Eve. 

Separable attacks. Within the separable attacks we 
can identify points (2), (3), and (4) in Eig. |21 These are 
characterized by the condition = \g'\ = ui — 1 and 
represent the separable attacks with the highest correla¬ 
tions. In particular, points (2) correspond to the cases 
g = g' = uj — lorg = g' = l — UJ, point (3) corresponds 
to g = —g' = UJ — 1, and point (4) to g = —g' = 1 — uj. 

EPR attacks. Einally, points (5) and ( 6 ) in Fig. |2] are 
the most entangled attacks, where Eve’s ancillas Ei and 
E 2 are described by an EPR state. Point (5) is the ‘pos¬ 
itive EPR attack’ with g = —g' = \/uj'^ — 1, while ( 6 ) is 
the ‘negative EPR attack’ with g = —g' = —^JuS^ — 1. 
The latter turns out to be the optimal attack against the 
protocol. 

We now compare the performances of the previous at¬ 
tacks in Eigs.|3]and|4l In Fig. [3] we fix the transmissivity 
r = 0.9 and we study the corresponding rates R as func¬ 
tion of the thermal noise uj. In Fig. 2] we plot the security 
thresholds. These are given by the condition R = 0, and 
they are expressed in terms of maximum tolerable ther¬ 
mal noise versus transmissivity uj = uj{t). 

Our analysis identifies “good” and “bad” entanglement 
for the security of the protocol. Good entanglement 



FIG. 3: (Color online) Secret-key rate R (bits) versus thermal 
noise uj for the various symmetric attacks (l)-(6) classified in 
Sec. IIVI and displayed in Fig. (2] Link-transmissivity is set to 
T — 0.9. Note that the negative EPR attack (6) is the optimal 
attack minimizing the rate of the protocol. 



FIG. 4: (Golor online) Security threshold {R = 0) ex¬ 
pressed as maximum tolerable thermal noise uj versus link- 
transmissivity T. We compare the various symmetric attacks 
(l)-(6) classified in Sec. IIVI and displayed in Fig. (2] The neg¬ 
ative EPR attack (6) is the optimal corresponding to the low¬ 
est security threshold. Also note the peculiar inversion of the 
threshold for the positive EPR attack (5), for which the rate 
is positive for values of thermal noise above the threshold. 


refers to the entangled attacks in the bottom right area 
of Fig. |2l with g = —g' > 0, of which the attacks (3) 
and (5) are border points. This entanglement is good 
because it injects correlations of the type gEi ~ 9 E 2 and 
PEi ^ —PE 2 J therefore helping the Bell detection (which 
projects on gA’ ~ Qb’ and pA' ~ —PB')- As a result. Eve 
actively helps the key distribution. 

This is evident from the performance of the positive 
EPR attack (5) both in terms of rate (Eig. [3]) and se¬ 
curity threshold (Fig. 0]). In fact, from Fig. [31 we see 
that the rate is increasing in the thermal noise uj and, in 
Fig. m we see a peculiar inversion of the security thresh¬ 
old so that thermal noise above the threshold is tolerable. 
These features are typical of all entangled attacks with 
w — 1 < g < \/uj'^ — \ and g' = —g, corresponding to 
the segment of points between (3) (excluded) and (5) 
(included). In Figs. ElandIH these attacks have curves 
which are intermediate between those of (3) and (5). 

By contrast, bad entanglement refers to the entangled 
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attacks in the top left area of Fig. [2 with g = —g' < 0 
and having the attacks (4) and (6) as border points. This 
entanglement is instead bad because it injects correla¬ 
tions of the type qE^ ~ PEi ^ PBa) which are 

opposite to those established by the Bell detection. In 
this case, Eve decreases the correlations between Alice’s 
and Bob’s variables, and she is able to eavesdrop more 
information, with the optimal strategy achieved by the 
negative EPR attack (6) as clear from the rates of Fig. [3] 
and the security thresholds of Fig. U) The asymmetric 
version of this attack is optimal in case of asymmetric 
setups 0. 

By comparing the curves (6) and (1) in Figs. [3] and SI 
we clearly see the substantial advantage given by this 
optimal attack with respect to the standard collective 
attack based on independent entangling doners. Analyt¬ 
ically, the minimum key rate associated with the optimal 
attack is given by 


.^min — h 


T -\- 2A, 


opt 


loga 


_e^Aopt('r F Aopt)_ 


( 22 ) 


a coherent attack where the ancillas are maximally en¬ 
tangled with a specific type of EPR correlations (negative 
EPR attack). In particular, this attack greatly outper¬ 
forms the standard collective attack based on indepen¬ 
dent entangling-cloners, which is therefore unsuitable for 
assessing the security of this kind of protocol (contrary to 
the claims of other analysis [1,0). This also confirms 
the results of Ref. 0 which were given in the general 
case of asymmetric setups. 

Finally our work clarifies the crucial role of quantum 
correlations in assessing the security of QKD protocols 
which are based on untrusted relays. Further studies 
may include the extension of this protocol to thermal- 
QKD [11133,1311, with the aim of using different wave¬ 
lengths of the electromagnetic field, e.g., in mixed tech¬ 
nology platforms using both optical/infrared and mi¬ 
crowave carriers. 
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with Aopt = (1 — 'r)(a; + — 1). One can easily check 

this is numerically much less than the rate of the collec¬ 
tive attack 


.^coll — ^ 

+ 1 72 


T + 2(1 — t)li. 


e^(l — t)[t + (1 — r)a;]o 


(23) 


Thus, the security analysis which is valid for one-way 
continuous-variable QKD protocols [l^, and based on 
the study of collective (single-mode) entangling-cloner at¬ 
tacks, cannot be applied to our relay-based protocol. For 
this reason, the studies provided by Refs. [l3,0 are in¬ 
complete and cannot prove the unconditional security of 
the relay-based (measurement-device independent) QKD 
with continuous variables. 


V. CONCLUSIONS 

In conclusion, we have provided a detailed analysis of 
the relay-based QKD protocol of Ref. 0 , considering a 
completely symmetric setup under the action of symmet¬ 
ric attacks. Despite the fact that this particular case does 
not represent the optimal configuration of the scheme, 
still it is important for its potential implementation in 
network scenarios. Furthermore, the symmetry condi¬ 
tions allow us to greatly simplify the cryptoanalysis and 
derive simple analytical results. 

Thanks to this approach, we have been able to provide 
a very detailed classification of the symmetric attacks 
against the protocol, characterizing the different possi¬ 
ble strategies in terms of their correlation properties. At 
fixed transmissivity and thermal noise, we have identi¬ 
fied the optimal symmetric attack which corresponds to 
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Appendix A: Extension to experimental 
imperfections 


In this appendix we analyze the role of experimental 
imperfections computing the key-rates and the security 
thresholds in the presence of Bell detectors with non¬ 
ideal quantum efficiencies. We also study finite-size ef¬ 
fects connected with finite Gaussian modulations [l3l| . 
and the role played by the non-ideal efficiency of the 
classical reconciliation codes [s^- We show that, also 
in the presence of realistic experimental limitations, the 
optimal eavesdropping is given by the two-mode coherent 
“negative-EPR attack”. 


1. Post-relay covariance matrix for non-ideal Bell 
detectors 

We generalize Eq.® to include detectors’ efficiencies 
by placing two beam splitters with transmissivities g and 
g', as illustrated in Fig. [S] To preserve the purity of 
the global (Alice-Bob-Eve) state, the non-detected sig¬ 
nals are sent to Eve’s quantum memory (this is the as¬ 
sumption to make in the worst-case scenario, since the 
relay is untrusted and Eve can control the loss of the 
detectors). 

We follow the general approach given in Ref. 01 ■ We 
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FIG. 5: (Color online) Untrusted relay with inefficient de¬ 
tectors. Two additional beam splitters, with transmissivities 
{rj, rj') are placed in front of the ideal detectors. One output 
from each beam splitter is sent to the detectors for measure¬ 
ments. The other outputs are sent to Eve’s quantum memory. 


write the total CM in the block form 


Here the quantum efficiencies of the detectors, simulated 
by the beam splitter transmissivities rj and rj', are con¬ 
tained in the symmetric matrix 

In the case of a Bell detection the matrix 7 ( 77 , t]') 
can explicitly be computed, according to Eqs. (54-59) 
of Ref. M- In particular, its entries take the form 

1 — T] 

liiv) = 7i H-, 

1] 

, 1 - V 

72 (b ) = 72 H- 

T] 

73 = 0 (A9) 

where 7 i = Tfi+{l—T){uj—g) and 72 = Tfj,+ {l—T){uj+g') 
are easily obtained from Eq. (jA3l) and (IA4I) . using the 
formulas of Ref. [l^ . 

After simple algebra we derive the post-relay CM in¬ 
clusive of the quantum efficiencies 


V = 


Vab C\ 

B J ’ 


where the block 


B = 


Bi D \ 
B 2 J 


(Al) 


(A2) 


describes the modes sent to the relay, A! and B'. These 
are processed by the balanced beam splitter and then 
measured. In our case it is easy to verify 0[il that 
the blocks Bi,B 2 and D take the following expressions 


Bi = B 2 = [r/r + (1 - r)w]I, (A3) 

D=(l-r)G, (A4) 

where I =diag(l, 1) and G =diag{g,g'). 

In Eq. dSB) the sub-matrix Vab describes the joint 
quantum state of remote modes a and 6 , while the block 
G = (Gj^G 2 ) is a rectangular matrix accounting for the 
correlations between the remote modes and the transmit¬ 
ted ones, i.e.. A' and B'. In particular, we compute 


Cl 


- 1)Z 

0 


C 2 = 


- 1)Z ) ■ 

(A5) 


Applying Eq. (74) from Ref. [l^ to Eq. (jAll) . we ob¬ 
tain Alice and Bob’s CM conditioned to the relay Bell 
measurement. This is given by 


^a &|7 V ah 


where 


2 det 7 (r 7 , rj') 


7) E c.(xU(^,./)x,)cy 

(A6) 


* 7 = 1.2 


Xi = 




(A7) 


"^0517 


>10' 

\ - 1 ) 

0 

/ 2 

1 

1 

7 l(*)) 

^ 71(1?) 

1 

72(17') 

71 (*7) 

71 (17) 

72(17') 

rewritten in the form 


\ 


72(*;') 

1 

12 h'} / 


'^a&|7 


fjl 0 
0 fil 

/ ' 


V- 1 ) 


V 


bt+Hv) 

1 

t)7+a7) 


1 

Tii+X{ri) 


Tfj.+X'(ri') ^ TH+X'(ri’ 

^ r/I+AUjy ^ 

Tfi+X'(ri') Tii+X'{ri') j 


where 


A(, 7 ) = (.;-ff)(l-r) + i^ , 

A'(7) = (^ + 5')(l-r) + i^ . 


(AlO) 


(All) 


Note that Eq. (lAlOl) could have been computed directly 
from Eq. ([ 6 ]) by applying the transformations 


A —>■ X' —>■ X'{g'). 


(A12) 


2. Asymptotic generalized key-rate 


Erom the previous CM we can write the sub-matrix 
describing Bob’s mode 


'^6|7 


_ — 1 ) 

^ Slr/T+Ifrjyf 


r(M - 1 ) 

2 [TiJ,+X'{ri')\ 


(A13) 







































Then, by applying Eq. m to the generalized CM of 
Eq. (lAlOl) . we derive the doubly-conditional CM of Bob, 
conditioned to both relay’s and Alice’s detections, i.e., 

„__ \ 

[r(M+l)+2A(r,)] \ 

u __ ] 

[r(/.+ l)+2A'(r,')] / 

(A14) 

We can now derive the symplectic spectra of the CMs 
of Eq. (lAlOl) and (IA14I) . We find simple analytical ex¬ 
pressions in the limit of large modulation. For we 

have the symplectic eigenvalues viirf) and V 2 (ri'), while 
for we have v{r], rj'). These eigenvalues can be ob¬ 

tained by applying the transformations of Eq. (IA12I) to 
the Eqs. ([5]) and (ITSl) . 

Using these spectra, we can compute the corresponding 
total and conditional von Neumann entropies and there¬ 
fore the Holevo bound. In the limit of large modulation. 
Eve’s Holevo information becomes 




lEhiv.fl') = log2 


eVA(?7)A'(??0// 

4t 



0) 



0 ) 


- h 


y'jr+ 2X{ri)][T+ 2X'{r)')i 

T 


(A15) 


which extends Eq. (HH) to arbitrary efficiencies rj and r]'. 

Similarly, we can extend the formula for Alice and 
Bob’s mutual information, which here becomes 


IaB\^ (??, v') = log2 


_Uf_ 

4\/[t +A(77)][T-b A'(?7')]’ 


(A16) 


for large modulation. Combining the previous results, we 
derive the asymptotic key-rate in the presence of detector 
inefficiencies 


FIG. 6: (Color online) The key-rate R (bits) is plotted versus 
thermal noise ca for /r = 10 (SNU) (top-panel) and /i = 70 
(bottom-panel). Other parameters are r = 0.9, /3 = 0.95 and 
rj = rj' = 0.98. We compare two eavesdropping strategies: 
The collective one-mode entangling doner attack g' — g — 0 
(dotted black line) and the two-mode “negative EPR” attack 
g = —g' = —\JbP- — 1 (continuous black line). We see that 
the key-rate of the two-mode attack is always lower than that 
of the one-mode attack. For comparison, we have also plotted 
the performances in the case of ideal reconciliation (/I = 1), 
ideal detectors (j] = vl = 1) and large modulation (/r S> 1). 
These ideal performances are represented by the red curves, 
dotted for the one-mode attack and continuous for the two¬ 
mode attack. 


Rsym{v,v') = log 2 


+ h 


eVA(?7)A'(??')[T + A(? 7 )][t -h A'(?7')] 

(A17) 


\/[T-h2A(?7)][T-h2A'(?7')] 


which clearly extends the formula given in Eq. ®. 


3. Role of the imperfections on key-rate, security 
thresholds and achievable distances 

In this section we study in detail the combined role of 
the various experimental limitations and imperfections, 
confirming the main findings presented in the main body 
of this paper. We compute the key-rate and the secu¬ 
rity thresholds considering not only the realistic quan¬ 
tum efficiency of the detectors, but also the use of a finite 
Gaussian modulation and the non-ideal reconciliation ef¬ 
ficiency provided by realistic codes for error correction 
and privacy amplification. 


a. Secret key rate 

In order to extract a secret key, the honest parties must 
process their correlated data in stages of perform error 
correction and privacy amplification. This data process¬ 
ing is today implemented with a limited efficiency /3 < 1, 
for instance (3 ~ 0.95 -F 0.97 [H, To include this 
limitation, we have to multiply Alice and Bob’s mutual 
information by /3, and consider the realistic key-rate [T5 | 

i?(/3, n, r, w, g, g', g, g') = / 3 /as |7 - (A18) 

where lAB\-y and lE\-y are now computed considering fi¬ 
nite modulation p, besides non-ideal detector efficiencies 
g and g' (clearly these quantities must tend to Eqs. (IA15I) 
and (IA16I) in the limit of large modulation). 

In general, the mutual information can be computed 
from the formula IabIj = | log 2 U, where E is defined in 
Ref. 0 . Eve’s Holevo information can be computed us¬ 
ing the formula of the von Neumann entropy S = Tixh{x), 
with h{x) defined in Eq. @ and applied to the numeri¬ 
cal symplectic eigenvalues of the CMs given in Eqs. (lAlOl) 
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FIG. 7: (Color online) We plot the security threshold ui = 
tj(r) for jj, — 10 (top panel) and = 70 (bottom panel). Other 
parameters are /3 = 0.95 and rj = rj' = 0.98. We compare the 
two-mode negative EPR attack (continuous black lines) and 
the one-mode entangling doner attack (dotted black lines). 
Red curves refer to the ideal case P = rj = rj' — 1 and ^ ^ 1. 

and (IA14I) . In Fig. [51 we plot the key-rate of Eq. (IA18I) 
as a function of the thermal noise w for two values of the 
Gaussian modulation ^ = 10 (top) and fi = 70 (bottom) 
vacuum shot noise unit (SNU), and choosing t = 0.9, 
r] = r]' — 0.98 and /3 = 0.95. We see that the key-rate 
of a negative EPR attack is clearly lower than that of a 
collective one-mode attack. This behavior is generic by 
varying the previous parameters. 

b. Security thresholds and achievable distances 

Here we study the impact of the experimental limita¬ 
tions on the security thresholds, comparing the two-mode 
optimal attack with one-mode collective attack. The se¬ 
curity threshold is obtained by solving the equation 

R{l3,fj.,T,ui,g,g',ri,r]') = 0. (A19) 

In this equation, we fix the values of the Gaussian mod¬ 
ulation {g = 10 or 70), the reconciliation efficiency 
(/3 = 0.95), and the quantum efficiencies ry = 77 ' = 0.98. 
Then, for each attack, we can write the security thresh¬ 
old as oj = oj(t). The comparison is provided in Fig. 0 
where we see that the threshold of the optimal two-mode 
attack is always lower than the threshold of the one-mode 
collective attack. 

The previous analysis can be performed by express¬ 
ing the transmissivity in term of distances. In fact, we 



distance (Km) 



distance (Km) 

FIG. 8: (Golor online) This figure shows the security thresh¬ 
olds as w = aj(d), where d is the distance in km, assuming 
the loss rate of 0.2 dB/Km. As in previous figures we com¬ 
pare the two-mode negative EPR attack (solid lines) with 
the one-mode entangling-cloner attack (dotted lines). In 
the top panel, the red curves refer to the ideal conditions 
/3 = 77 = 77' = 1 and g 1 . The black curves refer to the 
non ideal case P = 0.95, 77 = 77' = 0.98 and g = 70 (SNU). 
The bottom panel shows the degradation of the performance 
as we increase the modulation from g = 70 (black curves) to 
g = 1000 (green curves), for /3 = 0.95, 77 = 77' = 0.98. 

may consider r = 10“^'^, where d is the distance in km, 
assuming the standard loss rate in fibre of 0.2dB/Km. 
The achievable distances are shown in Fig. [51 We see 
that moving from the ideal conditions (red curves, with 
fj = Tj = rj' = 1 and g 1) the performances deteri¬ 
orate. All others curves are obtained for realistic rec¬ 
onciliation efficiencies /3 = 0.95, and detectors efficien¬ 
cies 77 = rj' = 0.98. The top panel compares the ideal 
thresholds with the case g = 70 (black), while in the bot¬ 
tom panel we show the degradation of the performances 
while increasing the modulation from g = 70 (black) to 
g = 1000 (green). 

It is interesting to note the effect of the reconciliation 
efficiency on the optimal modulation variance. For values 
of /3 < I, the optimal modulation is not infinite. In fact, 
for the realistic value considered here, (3 = 0.95, we have 
a range of finite modulations 30 < /r < 70, for which the 
performances are improved. 


c. Discussion 

Here we summarize some important aspects emerged 
from this further analysis. First, we have shown that 
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positive key-rates are still achievable over the range of 
metropolitan distances in the presence of various exper¬ 
imental limitations. Second, the negative-EPR attack, 
already identified to be the optimal attack in the ideal 
case (see main text) continues to be the most powerful 
eavesdropping strategy also considering realistic experi¬ 
mental conditions, i.e., finite modulation, non-ideal rec¬ 


onciliation and non-ideal detectors. Third, the degrada¬ 
tion of the performances of the protocol does not come 
from the finite modulation (e.g., we checked that values 
as low as /r = 10 are still acceptable) but mainly from 
the quantum efficiencies of the detectors, rj and 77 ', and 
the reconciliation efficiency /3 of the classical codes. 


[1] B. Schneier, Applied Cryptography (John Wiley & Sons, 
New York, 1996) p.23. 

[2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. 
Mod. Phys. 74, 145 (2002). 

[3] SECOQC, 2007, http://www.secoqc.net 

[4] M. Peev et al., New J. Phys. 11, 075001 (2009). 

[5] Tokyo QKD network 2010, www.uqcc.org/QKDnetwork. 

[6] J. H. Saltzer, D. P. Reed, and D. D. Clark, Proceedings of 
the Second International Conference on Distributed Com¬ 
puting Systems (Paris, France, April 8-10, 1981). 

[7] P. Baran, IEEE Trans, on Comm. 12, pp. 1-9 (1964). 

[8] S. L. Braunstein, and S. Pirandola, Phys. Rev. Lett. 108, 
130502 (2012). 

[9] A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, 
and W. Tittel, Phys. Rev. Lett. Ill, 130501 (2013). 

[10] T. Eerreira da Silva, D. Vitoreti, G. B. Xavier, G. C. do 
Amaral, G. P. Temporao, and J. P. von der Weid, Phys. 
Rev. A 88, 052303 (2013). 

[11] S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook, 
S.L. Braunstein, S. Lloyd, T. Gehering, C.S. Jacobsen 
and U.L. Andersen, Nature Photonics 9, 397-402 (2015). 
See also arXiv. 1312.4104. 

[12] S. L. Braunstein and P. van Loock, Rev. Mod. Phys. 77, 
513 (2005). 

[13] C. Weedbrook, S. Pirandola, R. Garcia-Patron, N. J. 
Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Rev. 
Mod. Phys. 84, 621 (2012). 

[14] R. Garcia-Patron and N.J. Cerf, Phys. Rev. Lett. 97, 
190503 (2006). 

[15] M. Navascues, F. Grosshans, A.Acin, Phys. Rev. Lett. 
97, 190502 (2006). 

[16] Z. Li, Y-C. Zhang, F. Xu, X. Peng, and H. Guo, Phys. 
Rev. A 89, 052301 (2014). 

[17] X-C. Ma, S-H. Sun, M-S. Jiang, M. Gui, and L-M. Liang, 
Phys. Rev. A 89^42335 (2014). 

[18] Note that Ref. [17l| computed the rate of the protocol 

at fixed transmissivity r and thermal noise uj, since they 
fixed both r and e = — — However, while the 

latter formula provides the excess noise for standard one¬ 
way protocols [T^ it does not for the considered relay- 


based protocol (see Ref. m for the correct definition of 
excess noise in this more complex case). 

[19] G. Spedalieri, C. Ottaviani, and S. Pirandola, Open Syst. 
Inf. Dyn. 20, 1350011 (2013). 

[20] S. Pirandola, S. Mancini, S. Lloyd, and S. L. Braunstein, 
Nature Phys. 4, 726 (2008). 

[21] C. Weedbrook, C. Ottaviani, and S. Pirandola, Phys. 
Rev. A 89, 012309 (2014). 

[22] M.A. Nielsen and 1. L. Chuang, Quantum Computation 
and Quantum Information (Cambridge University Press, 
Cambridge, 2000). 

[23] M. M. Wilde, From Classical to Quantum Shannon The¬ 
ory (Cambridge University Press, Cambridge, 2013). 

[24] G. Giedke and J.I. Cirac, Phys. Rev. A 66 , 032316 

( 2002 ). 

[25] R. Renner, Nature Phys. 3, 645 (2007). 

[26] R. Renner, J.I. Cirac, Phys. Rev. Lett. 102, 110504 
(2009). 

[27] S. Pirandola, S. L. Braunstein, and S. Lloyd, Phys. Rev. 
Lett. 101, 200504 (2008). 

[28] S. Pirandola, A. Serafini, and S. Lloyd, Phys. Rev. A 79, 
052327 (2009). 

[29] S. Pirandola, New J. Phys. 15, 113046 (2013). 

[30] C. Weedbrook, S. Pirandola, S. Lloyd, and T.C. Ralph, 
Phys. Rev. Lett. 105, 110501 (2010). 

[31] C. Weedbrook, S. Pirandola, and T.C. Ralph, Phys. Rev. 
A 86 , 022318 (2012). 

[32] Paul Jouguet, Sebastien Kunz-Jacques, Anthony Lever- 
rier, Phys. rev. A 84, 062317 (2011). 

[33] P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, 
E. Diamanti, Nat. Photonics 7, 378 (2013). 

[34] Note that, in the presence of a pure-loss attack (tj = 1 
and g ~ g' = 0), the non-unit quantum efficiencies of the 
detectors can be included in the loss of the channels. For 
simplicity, for 77 = 77 ' we can write 

r T 77 

rp J- \{r]) r77p J- 1 — r77 

which is equivalent to consider rg in the CM of Eq. ®. 





